Human Negligence to Blame for the Majority of Insider Threats

In 98% of the assessments conducted for its research, Dtex found employees exposed proprietary company information on the Web - a 20% jump from 2018.

Nearly two-thirds (64%) of insider threats are caused by users who introduce risk due to careless behavior or human error, according to new research from Dtex. This compares to 13% of threats due to compromised credentials and 23% caused by intent on harming the organization.

"That 64% number is huge and something we think companies should focus on," says Rajan Koo, head of Dtex's insider threat research team. "We find that by reducing the number of negligence incidents, companies can cut down on the potential of their employees being compromised."

In related research released this week, Endera reported that companies suffer from at least three workforce-related incidents per week, adding up to 156 incidents per year. And, according to Egress Technologies, more than four out of five companies (83%) have had employees expose customer or business data.

Lock Down Those LinksIn 98% of the assessments conducted for its research, Dtex found employees exposed proprietary company information on the Web – a 20% jump from 2018. Typically they send out a document via an insecure link to a colleague or third-party company using file-sharing tools that are unsanctioned by the company, Koo said.

"What happens is people will send a link from their personal Google Docs or Dropbox account, not realizing that the link is not secure," he explains. "In our research, we've found that these documents get indexed on Google and other search engines so the bad guys can easily find them publicly on the Web. We recommend that people lock down any links they send with a user name and password."

The study also found that in 95% of the assessments, employees looked to circumvent company security policies – a notable jump from 60% last year. In many instances, people are using private VPNs and TOR browsers in the hope of shielding their activities, Koo says. While often employees are simply looking to bypass security so they can do their work more efficiently, Dtex has found the use of such tools is often motivated by malicious intent.

Dtex also runs assessments that track whether a person is a flight risk, which Koo defined as a person with a “propensity to leave.” The company found employees engaging in such behavior in 97% of its assessments.

"What we'll do is track people who have spent a lot of time updating their LinkedIn profile or posting their resume and then watch to see if they've made a data transfer to a USB," Koo says. "In almost every organization, people tagged with a high propensity to leave typically take data with them. For each organization we've studied, we find at least one example of this a year."

Koo says security pros have become really good at protecting the perimeter from malware attacks. But as the perimeter erodes with more people working from home, the introduction of cloud-based apps, and the entrance of a younger, digitally fearless workforce who may log onto a corporate network from an insecure outside network, a new crop of user behavior intelligence platforms has surfaced.

These platforms enable companies such as Dtex, Endera, and others to leverage user behavior analytics to more efficiently detect insider threats.

Avivah Litan, a vice president and distinguished analyst at Gartner, says this emerging field of user behavior analytics has been a missing piece in corporate security profiles – until now.

"Dtex and other companies, along with the traditional SIEM vendors, have solutions … that sit on the user's device and can see things that you can't see from the cloud," Litan says. "Companies need to take a look at monitoring users, but do it in a way that respects privacy."

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

Steve Zurier has more than 30 years of journalism and publishing experience, most of the last 24 of which were spent covering networking and security technology. Steve is based in Columbia, Md. View Full Bio

This should come as a surprise to nobody. 'Gee, that email looked real enough?" And that invoice looked nice. Maybe I did get a refund. Users are always the weak link. The weight of infections delivered through phishing attacks is immense and yet, people still click and click. This is no surprise at all.

Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.

It was found that dropbear before version 2013.59 with GSSAPI leaks whether given username is valid or invalid. When an invalid username is given, the GSSAPI authentication failure was incorrectly counted towards the maximum allowed number of password attempts.

** DISPUTED ** In PCRE 8.41, after compiling, a pcretest load test PoC produces a crash overflow in the function match() in pcre_exec.c because of a self-recursive call. NOTE: third parties dispute the relevance of this report, noting that there are options that can be used to limit the amount of st...

** DISPUTED ** LibTIFF 4.0.8 has multiple memory leak vulnerabilities, which allow attackers to cause a denial of service (memory consumption), as demonstrated by tif_open.c, tif_lzw.c, and tif_aux.c. NOTE: Third parties were unable to reproduce the issue.